dashboard: remove the state-file endpoint, the file_refs path scan and the unused marked and dompurify deps

docs/web-ui/dashboard.md

@@ -555,23 +555,6 @@ below — some endpoints aren't in it yet.
   stdout+stderr as `text/plain`. Used by the `↓ raw` / `↓ download
   raw` links in the build tabs. Works on both finished and in-progress
   build logs.
-- `GET /static/marked.js` serves the vendored `marked` bundle used
-  for markdown previews.
-- `GET /api/state-file?path=<host-or-container-path>` — bounded
-  text read of a file under the per-agent `state/` subtree or
-  the shared `/var/lib/hyperhive/shared/`. Accepts the
-  container-view forms (`/agents/<n>/state/...`, `/shared/...`)
-  and the host form. Canonicalises + verifies the path stays
-  inside the allow-list, refuses anything but a regular file,
-  refuses `/agents/<n>/claude` / `config` subtrees, truncates
-  bodies at 1 MiB. No dashboard page calls it since the flow page
-  stopped existing.
-
-  The broker forwarder still detects path tokens **server-side at
-  broker-message ingest**: it calls `scan_validated_paths(body)` —
-  same allow-list helper the read endpoint uses — and attaches
-  the verified file tokens to the event as `file_refs: Vec<String>`.
-  No dashboard page reads that list either.
 - `GET /api/reminders` — list pending reminders for the
   dashboard's queued-reminders panel.
 - `GET /api/stats-hive?window=<1h|4h|24h|3d|7d|30d|all>` — hive-wide